K. Rustan M. Leino Microsoft Research, Redmond, WA 10 Oct 2007 IFIP WG 2.3 meeting Santa Fe, NM

Static program verifier (Boogie) MSIL SMT solver (Z3) V.C. generator Inference engine verification condition “correct” or list of errors Spec# compiler Spec# BoogiePL C Translator VerifiedC HAVOC C

a := o.f o.f := a a := Heap[o,f] a := select(Heap, o, f) Heap[o,f] := a Heap := Heap[o,f := a] Heap := store(Heap, o, f, a)

a := r.f r.f := a a := r [ f ] a := select(r, f) r [ f ] := a r := r [ f := a ] r := store(r, f, a)

(  r,f,g,a  f = g  select(store(r,f,a), g) = a) (  r,f,g,a  f  g  select(store(r,f,a), g) = select(r,g))

Types find errors in translation Some types are required by some provers (e.g., SMT Lib)

Heap: ref x Field  Value HeapBool: ref x Field  bool HeapInt: ref x Field  int … Heap: . ref x Field   

type Record; type Field  ; function select: . Record x Field    function store: . Record x Field  x   Record

type R; type F  ; function select: . R x F    function store: . R x F  x   R

(  : type  (  r: R, f: F , g: F , a:   f = g  select(store(r,f,a), g) = a)) (  : type,  : type  (  r: R, f: F , g: F , a:   f  g  select(store(r,f,a), g) = select(r,g))) type error

(  : type  (  r: R, f: F , g: F , a:   f = g  select(store(r,f,a), g) = a)) (  : type  (  r: R, f: F , g: F , a:   f  g  select(store(r,f,a), g) = select(r,g))) (  : type,  : type |     (  r: R, f: F , g: F , a:   select(store(r,f,a), g) = select(r,g)))

(  : type  (  r: R, f: F , g: F , a:   f = g  select(store(r,f,a), g) = a)) (  : type,  : type  (  r: R, f: F , g: F , a:       f  g  select(store(r,f,a), g) = select(r,g)))

class C { int x; bool y; void M() modifies this.x, this.y; { … } const x: Field int; const y: Field bool; procedure M(this: ref); modifies Heap; ensures (  : type  (  o: ref, f: Field   Heap[o,f] = old(Heap)[o,f]  (o = this  f = x)  (o = this  f = y)  … )

How to generate verification conditions targeting a theorem prover whose input is untyped formulas, or multi-sorted formulas and has no direct support for parametric polymorphism, type constraints, guarded types, … ?

What types to include in BoogiePL 2? How to type equality? How to translate into more primitive type systems? perhaps let this drive the other issues?